Google Android: Race condition enabling privilege escalation in TIPC driver
Summary
A race condition in the handle_chan_msg function of the Android kernel TIPC driver (tipc_virtio_dev.c) allows concurrent modification of shared memory. This can bypass memory tag access controls. A local attacker who already has System-level privileges can use this to escalate privileges further. No user interaction is required, and the bug does not affect remote, internet-facing services.
Affected
- Android kernel (tipc_virtio_dev.c), affected Android versions and device models not stated in the sources
- Pixel devices with a security patch level before 2026-11-05 are affected
Fixed in
- Security patch level 2026-11-05 or later (Pixel Update Bulletin, November 2026)
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact
- Third-party aggregator OffSeq reports no known exploitation and no weaponization evidence
- No public proof of concept found
Our recommendation
- Make sure Pixel devices reach security patch level 2026-11-05 or later and verify the level on each device
- Prioritise Pixel fleets and managed mobile devices where users could run malicious apps
- Track the NVD entry for a confirmed CVSS score and any change in exploitation status
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Pixel Update Bulletin, November 2026 source.android.com
- OSV record PUB-A-511812424 osv.dev
- Android acknowledgements source.android.com
- Strix CVE summary www.strix.ai
- OffSeq Radar threat entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:46.
Original description (NVD)
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.